Wednesday, August 17, 2016

The Unknown IBM i - An Amusing Tale From My Recent Travels.

Published on August 15, 2016

Bob Losey

Certified IBM Advanced Business Partner at IBM POWER (iSeries/AS400) Specialist | IBM i (i5 OS/OS400) Specialist

Many of you may be old enough to remember the Gong Show and the “Unknown Comic” who wore a paper bag over his head. You could not see his face, so you did not know who he really was. That was part of the gag.
I have a similar tale. Too bad the punchline of this real story is so true.
I recently traveled to Salt Lake City to visit four clients.
After checking in to my hotel, I drove to a nearby restaurant for dinner.
The restaurant had very friendly service. The mid-twenty year-old waitress shared with me that she had served overseas in the armed services. Now she was studying to get her MBA and someday wanted to start her own healthcare company. I was very excited for her.
Then she asked what I did for work.
“I work with technology. I work with users of a technology you may not have heard of … IBM i.”
Structured Query Language Integrated In OS
“What’s that?” she asked.
I asked, “Are you familiar with SQL?”
“Of course,” she said. “It is Structured Query Language. It’s used for managing a relational data base.”
I was impressed with her knowledge. I continued. “As you may know, with most SQLs such as MS SQL or Oracle, the application logic and operating system are separate.”
She acknowledged, “That’s right.” She had a good understanding of SQL and software.
I continued, “Imagine if SQL was integrated in the operating system.”
“Wow,” she said with surprise, “That’s possible?”
Imagine SQL In The Background
“Yes. And, imagine that the server could manage itself so it optimized the SQL database in the background, so you did not have to.”
“Wow. That’s also possible?”
Virus Free And Can’t Be Hacked
“Better still, the way the system is designed, unless you have the proper credential you cannot hack it and the system is virus free.”
“That’s really impressive,” she said.
“Now, imagine this system is very reliable. It does not ‘lock up’ or suffer ‘the blue screen of death’ like older versions of Windows.”
“I have never heard of anything like that.” She was intrigued.
Salt Lake City Clients With 70-200 Users, Only 1 IT Person Needed
“You told me you also work in a clinic with Windows and you have an IT staff of 5 for 50 users. My Salt Lake City clients have 70 to 200 users on this technology with 1 person managing the server,” I explained.
“That’s unbelievable. I have never heard of such a system. What is it?”
“It’s called IBM i. Also known as AS400 or iSeries.”
Never Heard Of It But Could Really Use It
“Cool. I wonder why I have never heard of it before. We could really use that at my clinic.”
Seems to me IBM i is like the Unknown Comic with the paper bag over his head. Seems like no one other than those who work with IBM i know what it is.
Unknown Until Known
Then, once they get it, they are amazed.

Sunday, May 29, 2016

Townsend Brings Modern Crypto Capabilities To Legacy RPG Apps

Published: May 18, 2016

by Alex Woodie

The field-level encryption capability that IBM introduced with IBM i 7.1 is a powerful tool for securing sensitive data. However, IBM i shops that have not modernized their legacy RPG applications with SQL access methods find it difficult to use. That should change with new technology coming out of Townsend Security this week at the COMMON conference in New Orleans.

The DB2 field procedure exit point that IBM launched in 2010 helped a lot of IBM i shops to encrypt their data on a field-level. The capability to encrypt pieces of sensitive data residing in particular parts of their DB2 for i databases, while leaving other pieces of data untouched, was a blessing to companies in retail, healthcare, and financial services industries struggling to comply with tough new security mandates.

However, the FieldProc came with a catch. While it worked just fine if your IBM i application accessed data via SQL calls, it didn't work quite so well for older RPG applications using native I/O methods to access the database. The FieldProc method proved especially troublesome for companies that organized their databases in a particular way--when they built column-level indexes for sensitive data.

Patrick Townsend, the CEO and founder of Townsend Security, explains the significance. "Many--perhaps most--IBM i customers have not been able to leverage FieldProc automatic encryption because of the inherent limitations in legacy RPG I/O," he tells IT Jungle via email. "Encrypted indexes just don't work as expected with the older I/O model."

IBM's path forward for these IBM i shops entails re-engineering RPG applications to use the SQL Query Engine (SQE). "But this means a huge investment for most IBM i customers that provides little in the way of business improvement," Townsend adds. "So most IBM i customers have been on the sidelines."

So Townsend decided to do something about it, using another relatively recent piece of IBM technology: Rational Open Access: RPG Edition, which is sometimes called OAR, ROAR, or RPG OA.

Wednesday, May 4, 2016

Open Source and IBM i

Apr 12, 2016Tim RoweIBM Announcements 1 Comment

With the latest IBM i 7.3 announce, the IBM i platform has continued down the path of transforming the ‘Art of the Possible’ when it comes to developing applications on IBM i for both today and on into the future. A significant part of this transformation is centered around open source. Not just the opportunity to run open source on IBM i but also how open source has been affecting all aspects of application development on IBM i.
One of the big concerns that I hear from many customers is about finding development resources both today and into the future. So what are we at IBM i doing to address this problem?

Modern RPG

RPG has been the primary language for IBM i since day one. It was created back in the day when punch cards roamed the earth. It has always been super at transactional processing and tight integration with the database. While punch cards have long since gone extinct, the need for transactional processing to run a business has not. For more than a decade we have been in the process of re-inventing the RPG language. With the announce of IBM i 7.3, the default for RPG on IBM i is a very modern variety. With the delivery of full free format a few years ago, the RPG language took a significant step forward towards the modern developer. With the latest new update, one of the last remnants of the punch card has been removed. RPG no longer has the an 80 column restriction. This is a significant step forward as now by leveraging fully free format RPG and storing your source in the IFS you have the opportunity to leverage a number of open source tools directly as part of your RPG development.
With fully free form support, embedded SQL, integrated XML processing and the latest in development tools with Rational Developer for i, you have the ability to leverage the skills of modern developers. You are no longer tied to only being able to hire an RPG Programmer. Modern developers can deal with many languages, and today’s RPG is no longer something that will be foreign to them.

PHP

PHP is our flag ship open source language on IBM i. We have had a great partnership with Zend over the years and we have huge numbers of IBM i customer that are leveraging PHP today to provide a modern front end to their business applications. We have many examples of customers that are innovating their business not just from a ‘pretty face’ perspective. By leveraging modern interfaces and moving the UI into the hands of the user, they are able to change business practices and in many cases save real money. With IBM i 7.3 we have updated the version of PHP that ships with the media and IBM i 7.3 supports the latest versions of PHP out of the box.
A little over a year ago now, the IBM i development lab delivered the new open source LPO – 5733OPS. This is our new open source delivery vehicle for IBM i. It shipped with 15 options, all but option 1 being empty to start. Well, in the past 15 months, we have significantly increased the number of options that have content. With the 7.3 announcement we are now up to 8, yes 8 options with all sorts of exciting new toys. Not only have we delivered new languages, but we have also looked at the entire picture. What are the other tools, utilities, and applications that are required to make the open source ecosystem on IBM i work.

Languages

Node.JS – Option 1 of 5733OPS contains the V0.1 stream for the Node.JS language. Additionally we included a tool kit built on our XML Service engine to provide access to your IBM i native objects and business logic. We also have included a SQL based database connector to allow quick, safe and secure access to your IBM i DB2 data. With all the interest in Node.JS from the community, this language continues to rapidly change and be enhanced. To ensure seamless upgrades from the old to the new, we are shipping the latest version of Node.JS V4 in option 4 of OPS. In addition to the new language support, we are also making significant updates to our database connector. As you may know, Node.JS is an asynchronous language. The original DB2 connector worked in a synchronous manner. Well, the new driver has been enhanced to provide an asynchronous connection as well. We are excited to see the potential that this new DB connector can provide to Node.JS applications.
Python – Last year we shipped Python V3.0 in Option 2 of OPS. We were pretty excited, with the latest version of Python figuring that was the correct choice. Well, in the Python community there happens to be a pretty big split. The V3.0 and the 2.7 crowd. Seems to be a pretty even split. So, we are now shipping Python V2.7 in option 5 of OPS. In addition to the integrated tool kit and the database driver that is included in both Python options, we are adding a new piece to the puzzle. We are including dJango. What the heck is dJango you ask ? It is a Web framework for Python that can simplify your task when creating Web applications with Python.

Ecosystem

GCC & CHROOT – The first piece to the ecosystem puzzles was something we delivered late last year. GCC is the standard open source complier that most all open source projects makes use of. On IBM i we have a C complier, works great actually, even optimized for the Power processor, it’s the XLC complier. But when the open source world uses GCC, often compiling code with a different complier can cause ‘interesting’ results. The CHROOT support is a way for you as, open source developers on IBM i, to create your own safe ‘sandbox’ for developing open source projects. You can update things in your environment and not effect the rest of the system.
GIT – The next piece of the open source puzzle that was announced with 7.3 was the GIT runtime. Git is the engine that powers the source control management software used widely in the open source community. It is the engine that Powers GitHub. Now with Git on IBM i, you can create your own ‘on prem’ source control library that leverages the latest open source support. Not only can you use it for all your open source projects, with modern RPG where the source is located in the IFS, you can also leverage GIT to control your RPG projects! There is even a GIT plugin that fits in nicely to your RDi development environment. GIT is being delivered in Option 6 of OPS.
Tools – Yea, I know, a real original name. But it is pretty descriptive. This option is intended to be a set of basic tools that every open source developer needs. Its going to start out pretty small, but I can see this growing over time as our IBM i community identifies additional ‘must have’ tools and utilities. The first to make the list are .zip and .unzip. Now we will have an easy to install .zip tool on IBM i!!! Just put on a PTF and you are done. Yea, we have been needing this one for a very long time. Additionally we are including the bash shell environment. These tools are being packaged in option 7 of OPS.
Orion – sounds like we have been gazing at the stars. Orion is a web based development environment. It’s a modern editor for writing open source applications. It has plugins for Node, Python and other open source languages. Yea, I know many developers have just used their own favorite editor from the community, but we felt that it was just not an integrated solution without this key tool. The other thing about Orion on IBM i, we have included a basic RPG syntax verifier! Again, leveraging Modern RPG and storing your source in the IFS, you can actually leverage Orion for simple RPG program updates. Orion is not intended to be a full feature/function IDE like RDi, but it is great for doing those quick simple updates. Orion will be included in Option 8 of OPS.

As you can see, with the announce of our latest IBM i operating system level, the IBM i continues to transform itself, by re-inventing pieces to insure that our platform can be successful today and into the future.

Wednesday, March 16, 2016

Verizon Outlines Disturbing AS/400 Breach At Water District

Verizon Outlines Disturbing AS/400 Breach At Water District
Published: March 16, 2016

by Alex Woodie

Cyber intruders who gained access to an AS/400 at a water district were able to manipulate the flow of chemicals into the public water supply, Verizon says in its latest Data Breach Digest. While customers served by the water district were not harmed, the episode shows the potential consequences of failure to properly secure critical systems in an increasingly connected world.

Verizon dedicated five pages to laying out the disturbing breach of a water district that it referred to as Kemuri Water Company (KWC), which is not a real name. The water district had first contacted Verizon's RISK Team to conduct a proactive assessment of its security system. KWC insisted it had never been compromised. However, after just a little probing, the RISK Team found evidence of an actual breach by a "hacktivist" group with ties to Syria.

According to details of the breach, the hacktivists first infiltrated KWC's systems by exploiting known security vulnerabilities in a Web-based payment server application that KWC had set up to allow customers to pay their bills and view water usage information. Unfortunately, that system was directly linked by cable to its backend "AS400" system. Making matters worse, the water district stored login credentials for the AS/400 on that front-end Web server, and the AS/400 was directly connected to the Internet.

KWC's aging AS/400 system (it was more than 10 years old, according to Verizon) served many purposes, as it does for most organizations that run the platform, which has gone through several name changes (iSeries, System i) and is now officially called IBM i for Power Systems by IBM. Among the applications are core financials, billing, and database containing personally identifiable information (PII) about customers.

SCADA Plot

The water district also used the AS/400 as a supervisory control and data acquisition (SCADA) system to directly control hundreds of programmable logic controllers (PLCs) that opened and closed valves that govern the flow of water and chemicals used to treat the water. Verizon's RISK Team found evidence that the hacktivists logged into this operational technology (OT) system and manipulated the valves controlling the flow of chemicals.

"It became clear that KWC management was aware of potential unauthorized access into the OT systems of the water district," Verizon says in its report. "More specifically, an unexplained pattern of valve and duct movements had occurred over the previous 60 days. These movements consisted of manipulating the PLCs that managed the amount of chemicals used to treat the water to make it safe to drink, as well as affecting the water flow rate, causing disruptions with water distribution."

The hackers also stole more than 2.5 million files that contained PII data, according to the report. There was no evidence that the data breach led to any fraudulent activity, Verizon says. That's not surprising, considering the hackers worked out of IP addresses that were used in previous hacktivist activities, the telco and IT giant says. "The typical semantic footprint of a hacktivist attack shows greater interest in denying and disrupting the victim's ability to conduct business than stealing information for financial gain," Verizon says in its report. "That was definitely the case here."

The bad news, of course, is that cyber criminals operating in the Middle East were able to release potentially dangerous chemicals into the public drinking water supply serving several counties in the United States. , KWC had systems in place to detect the chemical release and took immediate steps to fix the problem after being alerted to the problem.

"KWC's breach was serious and could have easily been more critical," Verizon says in its report. "If the threat actors had a little more time, and with a little more knowledge of the ICS/SCADA system, KWC and the local community could have suffered serious consequences."

Lessons Learned

From an IT and IBM i point of view, there are several lessons to be learned from the KWC breach. Some of the lessons are obvious, while others less so.

Among the basic lessons at play here are the need to apply patches and remediate known security vulnerabilities that affect Web applications. It's also not a good idea to store user names and passwords for critical systems like AS/400s in plain text on front-end Windows and Linux servers, or to expose backend servers like the AS/400 to the public Internet. This is the low-hanging fruit of IT security, but all too often, organizations continue to violate these basic tenets of security and rack up the "duh" moments by the dozen.

Having SCADA systems directly connected to front-end billing systems (as KWC had) is not a best practice, but is undoubtedly fairly common. Verizon also took KWC to task for employing a single administrator for the AS/400 system. While having duplicate hardware, software, and network connectivity is standard practice for many shops, having redundancy in personnel is also something worth considering.

But some of the other lessons from the KWC hack are not so obvious.

Not too long ago, OT systems such as SCADA were housed separate from IT systems, such as corporate networks and payment servers. That "air gap" served as a barrier to cyber snoopers and criminals. But as technology matured and data centers grew, organizations recognized there were benefits to grabbing more "real time" data from operational systems, and hence, that air gap disappeared. The problem is compounded by having IT administrators remotely manage OT systems over the Internet.

"This new technology can provide a false sense of security, as operating budgets do not take into account the time to support, maintain and operate the new technology--thus it becomes ineffective," Verizon concludes. "Threat actors have the upper hand when technology is not maintained and they develop ways to circumvent how it works. Continuous operational and security training, coupled with additional staff, are required to stay on the same level playing field as threat actors."

You can download a copy of the Verizon Breach Digest at www.verizonenterprise.com/verizon-insights/data-breach-digest/2016/.

Sunday, March 13, 2016

Zipping / Unzipping IFS Objects in IBM i

February 25, 2016 by Steve Bradshaw Leave a Comment

Those of you who know me probably know that I’m a lapsed programmer. These days I spend most of my time working at or below the IBM i Operating System layer but every now and then there is an exception that makes me dust off my coding skills and the recent need to Zip / UnZip files held in the IFS proved to be one such exception.

It started out with a simple request from a client saying that they would really like to be able to send and receive ASCII files stored in the IFS that were compressed and interchangeable with a standard Zip program on a Windows Server.

Initially I thought of cheating and just writing a script to do this from a Windows device that had the IFS folder in question mapped as a network drive. In the same moment I remember the countless times I had stood up in front of clients and user groups and told them just how flexible, open and downright fabulous IBM i is and I so realised there must be a better way. And of course there is!

QZIPUTL Service Program
Back in 2012 IBM added a service program called QZIPUTIL to v7.1 along with a couple of APIs QzipZip and QzipUnzip to IBM i, if you are running IBM i v7.2 or v7.1 with Cumulative level 2279 or higher then you will already have this.

Now, if want to ZIP / UNZIP files but you are about to abandon me as you are not an RPG developer or run on older versions of IBM i, stick around, I promise there are a couple of golden nuggets lurking just a few paragraphs further down.

Back to QZIPUTIL, to give the syntax of these APIs, the following charts are taken from the IBM Knowledge Centre. The links below them take you to those pages where you can get detailed information abouttheir usage, syntax and errors.

https://www-01.ibm.com/support/knowledgecenter/ssw_ibm_i_71/apis/QZIPZIP.htm

https://www-01.ibm.com/support/knowledgecenter/ssw_ibm_i_71/apis/QZIPUNZIP.htm

APIs are great but a command would be more useful.

APIs are of course great but for CL monkeys like myself an IBM i command would be much more useful. Ideally what we would want here are a couple of simple commands like ZIP and UNZIP.

In fact this is so startlingly fundamental, I truly don’t know why IBM did not add them. If you can think of a reason please feel free to enlighten me via the comments option at the bottom of this article. In fact the very lack of these commands was the very reason that I personally did not notice IBM had added this function to IBM i to v7.1 until just a few months ago!

Fortunately, thanks to a very generous and gifted gentleman called Carsten Flensburg, this is now possible in a matter of minutes. Carsten has created both ZIPF and UNZIPF command that you can freely download from the IBM Support website and upload to your server in minutes. Below is a link to the page on the IBM support website:
http://www-01.ibm.com/support/docview.wss?uid=nas8N1010418

Sample ZIPF command
Once created you can simply use the ZIPF command to compress a single file or a whole series of directories, subdirectories and objects. Below is a sample screen shot from this command:

Sample UNZIPF command
The UNZIP command is just as intuitive and like the ZIPF command to decompress a single file or a whole series of directories, subdirectories and objects. Below is a sample screen shot from this command:

Compatible with Windows ZIP files
I’ve only done limited tests so far but both the APIs and the commands above work flawlessly with their Windows counterparts. Please feel free to share your experiences with this via the post a comment option at the bottom of the article.

PCI Compliance
If you are worried that you cannot use these commands as they are not directly from IBM, the good news is that Carsten included the source to all his programs and it is this source that is compiled as part of the install so you have complete visibility over the code.

Pro Tip: If want a masterclass in how to write an IBM i installer without access to a complier, just check out the script he includes for uploading these commands, it is genius!

I’m sorry to bang on about Carsten, I’ve never met him and have no working relationship with him but this is the perfect example of how to write, deliver and add function to our community. If any of you know Carsten please give him a huge IBM i hug from me!

Zipping files in older versions of IBM i
If you are not yet running v7.x of IBM i, then firstly let me remind you that you’re running on an unsupported version of the operating system but you are not totally out of luck.

If you like QSHELL then you can always use the Java Archive (JAR) command but if you like your command line environment to be a little more normal then just google IBM i Zip commands and it won’t take you long to find functions like the ZIP/UNZIP commands created by Giovanni B. Perotti which run on systems with v5.2 onwards.

Nice to see you
It was great to see so many of you at the i-UG event at the Norton Grange, in Rochdale. We will repeat that event with the same agenda in Central London at Arrow ECS’s offices in the Royal Exchange on Thursday 3rd March. Hope to see you there, more details and registration available at www.i-ug.co.uk

Thursday, December 10, 2015

The IBM i OS Contains Everything Needed to Create Web Services

« Return to main article

The IBM i OS Contains Everything Needed to Create Web Services

October 2014 | by Tim Rowe

More Sharing ServicesShare|

Leveraging Web services for your IBM i applications allows you to continue to use your applications of today while also enabling you to repurpose key components in other applications or as the conduit between your UI and your back-end data and key business logic.

Web services can be a key component to a modernization project on IBM i. A “service” is a callable interface/method/routine that executes some business logic. It can be complex or very simple. What makes this different is this that it’s callable from the Web, providing a highly reusable interface that can be called from anywhere.

On IBM i, using Web services has never been easier. The OS includes an integrated Web services (IWS) runtime environment. The IWS is utilized today by thousands of IBM i users for a wide array of production services. In June 2014 IBM shipped the new Liberty and JAX-WS based runtime environment. This new technology base is built on the latest industry technologies to ensure a solid base for the future. The IWS server has been built and designed with the RPG or COLBOL developer as its primary user. The IWS support not only contains the necessary runtime environment for running Web services in an enterprise production environment, it also has wizards to help RPG and COBOL developers quickly and easily create and host Web services over back-end ILE programs with virtually no knowledge of the Web side of things. The best part about this support? Because it is part of the IBM i OS, you don’t need to purchase or install anything.

Getting Started

To get started with the IWS support, it’s recommended that you have the latest HTTP PTF and Java* PTF group levels installed. This will ensure you have access to the new Liberty-based IWS engine as well as any other goodies. This support applies to all currently supported releases of IBM i. Once your PTF group levels are set, (again this is not necessary unless you want to leverage the new Liberty-based server, which I highly recommend) you can create your Web services runtime hosting environment easily by walking through the create wizard found in the left navigation pane of the Web Administration GUI (open a browser, enter http://hostname:2001/HTTPAdmin) as shown in Figure 1 (right). Once your server is created and running, which should only take a couple of minutes, you are ready to deploy your first Web service.

When it comes to creating a Web service over your RPG or COBOL programs, the hard part lies on the ILE side, where the real work needs to happen. Because you are creating a service callable from anywhere, the RPG or COBOL program needs to conform to three rules:

You have to be using an ILE version of RPG or COBOL. The older versions are just not supported with the IWS-based support.

Your function that you are creating as a service must be a stateless callable program or service program. It can’t be dependent on an input or other things.

When you compile your code, you must specify the Program Call Markup Language (PCML) option as either a program header option or on the create program command. The PCML is a special object that’s embedded with your compiled program and tells the IWS support what the input and output parameters are for you program.

Once your ILE code is set, the fun part can begin. Creating your Web services is easy. From the Web admin GUI, click on the Manage Deployed Services link. Within this interface, click the Deploy button to start the Deploy a service wizard. This wizard consists of several steps; most are for more advanced features. You really only need to care about a few:

Specify the ILE program or service program object that contains your back-end function.

Define a name for your service. The wizard provides a default value based on the name of the program you specified, but I would recommend specifying a meaningful value, as it will be beneficial later when you are trying to remember what you just did.

Specify what functions you want to expose within this Web service. You can do this in several ways: one large Web service with many functions exposed or an individual Web service for each function you want to expose. I personally am a big fan of simplicity, and would create a simple Web service for each function.

R Update the input and output fields. You will notice the fields are already defined, but likely they aren’t completely accurate. If you’re returning an output structure, for example, it will likely be marked “input/output.” It’s best if you can change that to output and then be sure to designate the correct structure return size. This ensures that the IWS wrapper code handling the call back and forth between the world of the Web and the ILE program can process that data efficiently.

Specify the user ID that this ILE program will run against.

Specify the library list that will be used. The library list can easily be updated at a later time, so here you could specify test data library to get started and then update with the production library later.

R Click on “Next” on any additional screens and hit “Finish.” Within a few seconds the wizard will create the Web services wrapper and deploy it into your Web services runtime environment.

At this point you are set and ready to go! Within the deployed service interface, is a link to the Web Services Descriptive Language. That is the object you will need to send to the caller of your Web service. Try it out for yourself; click on the Test button to launch the IWS testing interface, specify your input values and verify your Web service is working as expected.

Helpful Wizards

Getting starting creating and hosting Web services for the IBM i has never been easier. A complete set of wizards help guide you along the path. For those that are wondering, the IWS support also has a complete set of callable scripts and interfaces to give you the ability to automate or easily move these services from one system to another.

Tim Rowe is the Business Architect for Application Development responsible for all middleware and infrastructure needed for applications on IBM i. He has spent the past 8 years as an architect for the IBM i Web integration team.

IBM i (iSeries, AS/400)